CVE-2025-34037: Linksys Routers E/WAG/WAP/WES/WET/WRT-Series
Linksys · E4200
Vendor fix available · Affected: Linksys E4200 · Exploitation: likely to be exploited (10% or more)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 99% of scored CVEs
DescriptionCVE.org
An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080. The CGI scripts improperly process user-supplied input passed to the ttcp_ip parameter without sanitization, allowing unauthenticated attackers to inject shell commands. This vulnerability was reported to be exploited in the wild by the "TheMoon" worm in 2014 to deploy a MIPS ELF payload, enabling arbitrary code execution on the router. Additionally, this vulnerability may affect other Linksys products to include, but not limited to, WAG/WAP/WES/WET/WRT-series router models and Wireless-N access points and routers. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.
Affected products11
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- Linksys · E4200before 1.0.06
- Linksys · E3200before 1.0.05
- Linksys · E3000before 1.0.06
- Linksys · E2500 v1/v2before 2.0.00
- Linksys · E2100L v1up to and including 1.0.05
- Linksys · E20000
- Linksys · E1550up to and including 1.0.03
- Linksys · E1500 v1before 1.0.06
- Linksys · E1200 v1up to and including 1.0.04
- Linksys · E1000 v1before 2.1.03
- Linksys · E900 v1before 1.0.04
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
CoverageNo articles yet
No CyberSIXT article names CVE-2025-34037 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.